jwt-oauth-token-attacks
jwt oauth token attacks
What it does
- oauth oidc misconfiguration for redirect URI, state, nonce, PKCE, and account-binding validation
- cors cross origin misconfiguration when browser-readable APIs or token leakage may exist cross-origin
- saml sso assertion attacks when the target uses enterprise SSO outside OAuth/OIDC
- Server's public key is often discoverable (JWKS endpoint, /certs, source code)
- Attack: tell server "this is HS256" → server verifies HS256 HMAC using the public key as secret
- Redirect to attacker page: fragment accessible via document.referrer or via <script>window.location.href</script> in target page
- Open redirect: redirecturi=https://target.com/open-redirect?url=https://attacker.com → token in fragment lands at attacker's page
Requirements & configuration
- SKILL: JWT and OAuth 2.0 Token Attacks — Expert Attack Playbook
- Use this file for token-centric attacks and flow abuse. Also load:
- cors cross origin misconfiguration when browser-readable APIs or token leakage may exist cross-origin
- Step 4: Construct token with empty signature:
- Server reads /dev/null as key → empty string → sign token with empty HMAC.
Configuration: SELECT
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
jwt-oauth-token-attacks FAQ
What does the jwt-oauth-token-attacks skill do?
>- JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses. oauth oidc misconfiguration for redirect URI, state, nonce, PKCE, and account-binding validation cors cross origin misconfiguration when browser-readable APIs or token leakage may exist cross-origin
What does jwt-oauth-token-attacks require?
SKILL: JWT and OAuth 2.0 Token Attacks — Expert Attack Playbook Use this file for token-centric attacks and flow abuse. Also load: cors cross origin misconfiguration when browser-readable APIs or token leakage may exist cross-origin Step 4: Construct token with empty signature: Server reads /dev/null as key → empty string → sign token with empty HMAC. Configuration keys: SELECT.
How do I install jwt-oauth-token-attacks?
Run: npx -y skills add https://github.com/yaklang/hack-skills --skill jwt-oauth-token-attacks --agent claude-code — the source lives at github.com/yaklang/hack-skills.
Maintain jwt-oauth-token-attacks?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[jwt-oauth-token-attacks on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-jwt-oauth-token-attacks?ref=badge) npx agentictools info skills/yaklang-hack-skills-jwt-oauth-token-attacks The second line is the CLI lookup for this page — handy in READMEs and docs.
